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Description 



METHOD AND APPARATUS FOR 
OPERATING AND CONTROLLING A 
POWER SYSTEM 

Background 

[0001] This disclosure relates generally to the operation and con- 
trol of a power system, and more particularly to a com- 
munication and control arrangement in a modular power 
system for providing a reliable and autonomously con- 
trolled power system. 

[0002] Discrete distributed power systems are used or contem- 
plated for use in numerous applications, including primary 
or backup power for high value commercial equipment 
such as telecommunications infrastructure, primary or 
backup power to commercial and residential buildings, 
and primary or backup power to renewable energy 
sources for use in non-ground-based systems such as a 
High Altitude Airship (HAA), for example. A typical pri- 
mary power system may include a power source such as a 



diesel or gasoline powered generator, a fuel storage tank, 
and a set of batteries to store energy, for example. A typi- 
cal renewable energy source may include Photovoltaic (PV) 
arrays, for example. In applications involving primary or 
backup power for a HAA, it is desirable to combine a re- 
newable energy source, such as PV arrays for example, 
with a regenerative energy source, such as a regenerative 
fuel cell system utilizing electrochemical cells for exam- 
ple. However, in HAA applications, there is a challenge to 
provide a system that is self sustaining during long-term 
missions of up to one year or more. While existing power 
systems are suitable for their intended purposes, there 
still remains a need for improvements for HAA applica- 
tions. In particular, a need exists for a power system with 
appropriate safeguards that will enable it to operate au- 
tonomously and reliably for extended periods of time. 
Summary of the Invention 

[0003] | n an embodiment, a method for operating a power sys- 
tem is disclosed. A plurality of sensor signals are received 
at a common data bus, where each sensor signal is repre- 
sentative of an operating characteristic of a power system 
module. The sensor signals at the common data bus are 
received and analyzed at a controller for the presence of 



an abnormal operating condition, and in response thereto 
it is determined whether an operational adjustment of the 
power system module is desirable. In response to the ex- 
istence of a desirable adjustment condition, the operation 
of the power system module is automatically adjusted. A 
first sensor of the plurality of sensors is arranged for pro- 
viding an operating characteristic that is derivable from 
one or more of the other sensors, the one or more other 
sensors including a different type of sensor than the first 
sensor, thereby providing redundant system information 
for determining whether an operational adjustment of the 
power system module is desirable. 
[0004] | n another embodiment, a control system for a power sys- 
tem includes a controller having a processor for executing 
instructions for monitoring sensor signals at a common 
data bus, receiving and analyzing the sensor signals to 
determine the existence of a malfunctioning device, and 
automatically reconfiguring other operational devices 
controlled by the control system to accommodate for the 
malfunctioning device. The common data bus is in signal 
communication with a plurality of sensors, where each 
sensor signal is representative of an operating character- 
istic of the power system, and the malfunctioning device 



includes a sensor, a processing element, an output device, 
or a control device. 
[0005] | n a further embodiment, a control system for a power 

system includes a processor for executing instructions for 
determining whether a sensor reports an abnormal oper- 
ating condition, and in response thereto, for determining 
whether the sensor is unhealthy. In response to the pres- 
ence of an unhealthy sensor, the processor executes in- 
structions for determining whether the operating charac- 
teristic sensed by the unhealthy sensor is derivable from 
one or more other sensors in the power system, the one 
or more other sensors including a different type of sensor 
than the unhealthy sensor. In response to the operating 
characteristic sensed by the unhealthy sensor not being 
derivable, the processor executes instructions for deter- 
mining whether an operational adjustment of the power 
system or a portion thereof is desirable. If an operational 
adjustment is desirable, the processor executes instruc- 
tions for automatically adjusting the operating condition 
of the power system or a portion thereof. 
Brief Description of the Drawings 

[0006] Referring now to the drawings wherein like elements are 
numbered and/or labeled alike in several Figures: 



[0007] Figure 1 depicts a schematic representation of an exem- 
plary power system for employing an embodiment of the 
invention; 

[0008] Figure 2 depicts a schematic representation of an exem- 
plary regenerative electrochemical cell modular power 
system for use in the system of Figure 1; 

[0009] Figure 3 depicts a schematic representation of an exem- 
plary anode feed electrolysis cell for use in the system of 
Figure 2; 

[0010] Figure 4 depicts a schematic representation of an exem- 
plary communication system for use in the system of Fig- 
ure 1; 

[0011] Figure 5 depicts an alternative communication system to 
the system of Figure 4; 

[0012] Figure 6 depicts an exemplary communications architec- 
ture for implementing an embodiment of the invention; 
and 

[0013] Figure 7 depicts an exemplary process for implementing 
an embodiment of the invention in the system of Figure 1. 
Detailed Description 

[0014] Embodiments of the invention provide a method and ap- 
paratus for providing modular power in a flexible power 
system defined by various operating modules, wherein the 



modules are in operable communication with each other 
and are controlled by a processor receiving and analyzing 
redundant system information, thereby providing a reli- 
able and autonomously controlled power system. 
[0015] Figure 1 is an exemplary embodiment of a power system 
10 having a renewable energy source, such as a Photo- 
Voltaic (PV) array for example, providing input power 20 
to a PV Interface 30, a regenerative electrochemical cell 
Modular Power System (MPS) 100, employing Proton Ex- 
change Membrane (PEM) processes for example, and an 
Output Power Conditioner (OPC) 40 that provides Power 
Out 50, which may be ac (alternating current) or dc (direct 
current) power. In an embodiment, MPS 100 includes an 
electrolyzer module (ELM) 200, a power module (PWM) 
300, a water storage module (WSM) 400, a hydrogen stor- 
age module (HSM) 500, and a controller module (CTM) 
600. CTM 600 is in operable communication with each 
power system module 200, 300, 400, 500 via communi- 
cation bus 110 (represented by dashed lines) and local 
controllers (LCC) 210, 310, 410, 510. Power system mod- 
ules 200, 300, 400, 500 are in power and/or fluid com- 
munication with each other via a conduit network 120. 
The fluid communication in conduit network 120 may al- 



low for hydrogen flow in either direction thereby providing 
more effective utilization of space within the confines of 
the MPS enclosure 130. In an embodiment, PWM 300 in- 
corporates technology for creating electricity from hydro- 
gen, such as a PEM fuel cell, or a generator (e.g., driven by 
an internal combustion engine, hydropower, wind power, 
solar power, or the like). As discussed herein, where PWM 
300 is configured as a fuel cell, it may also be referred to 
as a fuel cell module (FCM) 300. CTM 600 is also in oper- 
able communication with PV interface 30 and OPC 40 via 
communication bus 110. A more detailed schematic of 
MPS 100 is depicted in Figure 2, which shows ELM 200 
having an electrolyzer 700 and phase separator 215, and 
FCM 300 having an electrochemical fuel cell system 800. 
Other details relating to MPS 100 and depicted in Figure 2 
will be discussed further below. 
[0016] Referring now to Figures 2-3, electrochemical energy 
conversion cells employed in embodiments of ELM 200 
and FCM 300 will be discussed. Although embodiments 
disclosed below are described in relation to an electro- 
chemical power system including a proton exchange 
membrane electrochemical cell employing hydrogen, oxy- 
gen, and water, other types of electrochemical cells and/ 



or electrolytes may be used, including, but not limited to, 
phosphoric acid and the like. Various reactants can also 
be used, including, but not limited to, hydrogen, bromine, 
oxygen, air, chlorine, and iodine. Upon the application of 
different reactants and/or different electrolytes, the flows 
and reactions change accordingly, as is commonly under- 
stood in relation to that particular type of electrochemical 
cell. Electrochemical cells may be configured as electroly- 
sis cells or fuel cells, as will be discussed below. 
[0017] Referring now to Figure 3, an electrochemical cell config- 
ured as an anode fed electrolysis cell 702, which may be 
formed in a stack of one or more to form electrolyzer 700 
and employed in an embodiment of ELM 200, is depicted 
in section view having a proton exchange membrane 
(PEM) 705 arranged between an oxygen electrode (anode) 
710 and a hydrogen electrode (cathode) 715. Electrolysis 
cell 702 functions as a hydrogen generator by electrolyti- 
cally decomposing process water 720 to produce hydro- 
gen gas 725 and oxygen gas 730. Process water 720 is 
fed into electrolysis cell 702 at anode 710 to form oxygen 
gas 730, electrons, and hydrogen ions (protons) 735. The 
chemical reaction is facilitated by the positive terminal of 
a power source 740 connected to anode 710 and the neg- 



ative terminal of power source 740 connected to cathode 
715. Power source 740 may be internal or external to ELM 
200 and may include a battery or a connection to utility 
power or a renewable energy source. In an exemplary em- 
bodiment, power source 740 is fed by PV interface 30. 
Oxygen gas 730 and a first portion 745 of the water are 
discharged from electrolysis cell 702, while protons 735 
and a second portion 750 of the water migrate across PEM 
705 to cathode 715. At cathode 715, hydrogen gas 725 is 
removed, generally through a gas delivery line at conduit 
network 120. The removed hydrogen gas 725 is usable in 
a myriad of different applications. Second portion 750 of 
water is also removed from cathode 715. 
[0018] ELM 200 may include a number of individual electrolysis 
cells 702 arranged in a stack with process water 720 be- 
ing directed through the cells via input and output con- 
duits formed within the stack structure. Electrolysis cells 
702 within the stack are sequentially arranged, with each 
cell 702 having a membrane-electrode assembly (MEA) 
defined by a proton exchange membrane 705 disposed 
between a cathode 715 and an anode 710. The cathode 
715, anode 710, or both may be gas diffusion electrodes 
that facilitate gas diffusion to the proton exchange mem- 



brane 705. Each membrane-electrode assembly is in fluid 
communication with flow fields adjacent to the membrane 
electrode assembly and defined by structures configured 
to facilitate fluid movement and membrane hydration 
within each individual electrolysis cell 702. 

[0019] The water 750 discharged from the cathode side 715 of 
the electrolysis cell 702, which is entrained with hydrogen 
gas, may be fed to a phase separator 215 (see Figure 2) to 
separate the hydrogen gas 725 from the water 750, 
thereby increasing the hydrogen gas yield and the overall 
efficiency of electrolysis cell 702 in general. The removed 
hydrogen gas 725 may be fed either to a dryer 220 (see 
Figure 2) for removal of trace water, to HSM 500, which 
may be a cylinder, a tank, or a similar type of containment 
vessel, or directly to an application for use as a fuel, such 
as to FCM 300 (see Figures 1 and 2). 

[0020] Another type of water electrolysis cell (not shown) that 

utilizes the same configuration as is shown in Figure 3 is a 
cathode feed cell. In the cathode feed cell, process water 
is fed on the side of the hydrogen electrode. A portion of 
the water migrates from the cathode across the mem- 
brane to the anode. A power source connected across the 
anode and the cathode facilitates a chemical reaction that 



generates hydrogen ions and oxygen gas. Excess process 
water exits the electrolysis cell at the cathode side without 
passing through the membrane. 
[0021] a typical fuel cell system 800 (depicted in Figure 2) also 
utilizes the same general MEA configuration as the elec- 
trochemical cell of Figure 3, depicted therein as an elec- 
trolysis cell. In the fuel cell system 800 configuration, hy- 
drogen gas 725 is introduced to hydrogen electrode 715 
(the anode in the fuel cell system 800), while oxygen 730, 
or an oxygen-containing gas such as air, is introduced to 
oxygen electrode 710 (the cathode in the fuel cell system 
800). The hydrogen gas for fuel cell operation can origi- 
nate from a pure hydrogen source, a hydrocarbon, 
methanol, an electrolysis cell 702 such as that described 
above with reference to Figure 3, or any other source that 
supplies hydrogen at a purity level suitable for fuel cell 
operation. The hydrogen gas 725 electrochemically reacts 
at the anode 715 to produce protons 735 and electrons, 
the electrons flow from the anode through an electrically 
connected external load, and the protons 735 migrate 
through the proton exchange membrane 705 to the cath- 
ode 710. At the cathode 710, the protons and electrons 
react with oxygen 730 to form product water 720. 



[0022] The general operation of MPS 100 involves the delivery of 
water from WSM 400 to ELM 200, where the water is elec- 
trolyzed to form hydrogen and oxygen gas. The hydrogen 
gas is dispensed from ELM 200 to HSM 500, from which it 
is periodically retrieved and dispensed to FCM 300. Once 
received in FCM 300, the hydrogen gas is reacted with 
oxygen, from either an air supply 60 or from oxygen pro- 
duction at ELM 200, to produce electrons and water. In 
HAA applications, oxygen production at ELM 200 may be 
stored at oxygen storage device 70 for subsequent use at 
FCM 300. Power is distributed from MPS 100 by directing 
the electrons to output power conditioner 40 for subse- 
quent delivery, depicted generally as power out 50, to an 
attached load (not shown). Excess water is returned to 
WSM 400. The operation and control of MPS 100 and the 
distribution of power is governed by CTM 600, LCCs 210, 
310, 410, 510 and embedded application software, as will 
be discussed in more detail below. 

[0023] Referring now to Figure 4, an embodiment of MPS 100 in- 
cludes a plurality of ELMs 200, a plurality of PWMs 300, 
and a HSM 500, all in signal communication with each 
other via communication bus 110 and internal buses 295, 
395, 595, respectively. In an embodiment, communica- 



tions bus 110, LCCs 210, 310, 510 and internal buses 
295, 395, 595 may operate under a Controller Area Net- 
work (CAN) bus and associated communications protocol, 
where a broadcast communication is achieved by using a 
message oriented transmission protocol. Here, messages 
communicated between modules are identified by using a 
message identifier, which is unique within the network 
and not only defines the content but also the priority of 
the message. By utilizing a CAN scheme, MPS 100 can be 
upgraded by installing newer modules or additional mod- 
ules without having to make any hardware or software 
modifications to the existing modules. Other communica- 
tion schemes may be equally applicable for implementing 
the disclosed invention and may be substituted for the 
CAN protocol communication scheme. 
[0024] | n alternative embodiments, CTM 600 may be present and 
configured as a master control module to serve as a cen- 
tralized controller with LCCs 210, 310, 410, 510 operat- 
ing as local controller sub-systems, or may not be present 
as a separate module, but may have some or all of its 
functionality embedded within LCCs 210, 310, 410, 510, 
thereby providing for a distributed control scheme, or 
may be present with limited functionality to serve as a 



signal interface, such as provided by signal interface 605, 
to send and receive external signals 607 and communi- 
cate those signals with MPS 100. External signals 607 may 
be wired or wireless, and may employ radio frequency 
signals, microwave signals, optical signals, or any other 
type of communication signal appropriate for the environ- 
ment in which power system 10 is employed, such as in a 
HAA for example. Alternatively, CTM 600 and signal inter- 
face 605 may both be present in MPS 100 to provide co- 
ordinated signal processing. In an alternative embodi- 
ment, HSM 500 may be replaced with an integrate water 
and hydrogen storage module (WHSM), depicted generally 
at 900, in which case LCC 410 and LCC 510 may be inte- 
grated into one local controller, herein referred to as LCC 
510. In a further alternative embodiment, electrolyzer 
700, and accompanying necessary hardware, may be 
mounted or integrated into the assembly of HSM 500, 
thereby providing a more compact hydrogen generator 
and storage module. 
[0025] | n an embodiment, modules 200 and 300 include a com- 
munications port 945, depicted generally in Figure 4 as 
the connection point between communications bus 110 
and modules 200, 300, which is in signal communication 



with an associated local controller, 210 or 310 for exam- 
ple. In a centralized control scheme, data and control sig- 
nals from CTM 600 are communicated to the appropriate 
local controller of a module via communication bus 110 
and communication port 945. In a distributed communi- 
cation scheme, data and control signals from one local 
controller are communicated to another local controller 
via communication bus 100 and communication port 945. 

[0026] as depicted in Figure 4, ELM 200 and PWM 300 may in- 
clude power conditioning units 290, 390, respectively. 
Power conditioning unit 290 receives power from PV in- 
terface 30 and delivers conditioned power to electrolyzer 
700 at power source 740, and power conditioning unit 
390 provides power out 50 from fuel cell 800 via output 
power conditioner 40. In alternative embodiments, power 
conditioning unit 390 may be separate from or integrated 
with output power conditioner 40. 

[0027] Referring now to Figure 5, an alternative arrangement of 
ELMs 200 and PWMs 300 is depicted within power system 
10. Whereas in Figure 4 each ELM 200 and PWM 300 is 
depicted grouped with a like module, Figure 5 depicts 
each ELM 200 and PWM 300 grouped in a module set 
1000 along with other system modules, discussed further 



below, and with communication bus 110 providing a com- 
mon data bus between all modules. As depicted by el- 
lipses 1010, other module sets 1000 may be attached to 
communications bus 110, and to conduit network 120 
(shown in Figures 1, 2 and 4 and omitted from Figure 5 
for clarity). Figure 5 depicts each module set 1000 having 
a local controller 610, and ELM 200, a WHSM 900, a 
bridge 80, a PWM 300, and a power conditioner 90. Local 
controller 610 is similar to LCCs 210, 310, 410, 510, but 
serves to control the entire set of modules within module 
set 1000 as opposed to controlling only one type of mod- 
ule. Each system module within module set 1000 is re- 
ferred to simply as a system module, or power system 
module, and includes any one of the aforementioned 
modules 610, 200, 900, 80, 300 and 90. 
[0028] Similar to the discussion above, CTM 600 may be present 
and configured as a master control module to serve as a 
centralized controller with local controllers 610 of each 
module set 1000 operating as a local controller sub- 
system, or may not be present as a separate module but 
may have some or all of its functionality embedded within 
each local controller 610, thereby providing for a dis- 
tributed control scheme. In either arrangement, CTM 600 



and local controllers 610 may operate under a Controller 
Area Network (CAN) bus with associated communications 
protocol, as discussed above. CTM 600, LCCs 210, 310, 
410, 510, and local controller 610 include a processor 
620 and a memory 630, depicted in Figure 5, for storing 
and executing control instructions provided by embedded 
software, and for storing operational information such as 
operating characteristics in lookup tables for example. 
Processor 620 may be a microprocessor or any other pro- 
cessing device sufficient to control power system 10. 
Bridge 80 provides a similar function as power condition- 
ing unit 290 discussed above, but instead of serving con- 
ditioned power to just electrolyzer 700 it serves condi- 
tioned power to all modules within module set 1000, 
thereby reducing the number of components within and 
the overall size and weight of power system 10. Power 
conditioner 90 provides a similar function as power con- 
ditioning unit 390 and may also be separate from or inte- 
grated with output power conditioner 40. 
[0029] As mentioned above, the output power, depicted generally 
as power out 50, may be ac (alternating current) or dc 
(direct current) power. In alternative embodiments, the 
output power is provided at about 24 VDC (volts direct 



current) or about 48 VDC, depending on the market 
needs, and the input power at PV input 20 and PV inter- 
face 30 is provided at about 120/240 VAC (volts alternat- 
ing current), single-phase, at about 50/60 Hz (Hertz). 
However, MPS 100 may be designed to operate over a 
wider range of input voltages, such as from about 85 to 
about 264 VAC input, for example. An embodiment of 
MPS 100 has an output current of about 42 amps, with a 
minimum of about 0 amps and a maximum of about 45 
amps, at an output voltage of about 24 VDC +/- 0.5 VDC. 
In an embodiment, MPS 100 has an output voltage that 
deviates no more than about +/- 0.5 VDC in response to 
an ambient temperature variation from about -40 deg-C 
(degrees Celsius) to about +50 deg-C, and can operate at 
an altitude equal to or less than about 80,000 feet. 
[0030] | n an embodiment and referring to Figure 5, the opera- 
tional control of power system 10 by CTM 600, LCCs 210, 
310, 410, 510, and/or local controllers 610, is assisted by 
strategically placed sensors 1020, 1030 throughout power 
system 10, with sensors 1020 referring generally to sen- 
sors placed within an operational module to sense the op- 
erating characteristics of that particular module, and sen- 
sors 1030 referring generally to sensors placed to sense 



the operating characteristics of power system 10 as a 
whole. Sensors 1020, 1030 may be different types of sen- 
sors and include but are not limited to temperature sen- 
sors, depicted as a boxed-T 1040, pressure sensors, de- 
picted as a boxed-P 1042, and voltage sensors, depicted 
as a boxed-V 1044. As herein used, the nomenclature for 
identifying a module temperature sensor is 1020, 1040, 
and the nomenclature for identifying a system tempera- 
ture sensor is 1030, 1040. Other sensors, such as flow 
meters and ammeters for example, may be employed as 
appropriate for carrying out the control function herein 
disclosed. 

[0031] Also provided within power system 10 are control devices 
1050, 1060 for controlling the flow of power, fluid, gas, 
coolant, and heat, for example, within and between mod- 
ules of power system 10, with control devices 1050 refer- 
ring generally to devices placed within an operational 
module to control an operating characteristic of that par- 
ticular module, and control devices 1060 referring gener- 
ally to devices placed to control an operating characteris- 
tic of power system 10 as a whole. Exemplary control de- 
vices 1050, 1060 include but are not limited to pumps, 
depicted as a circled-P 1070, valves, depicted as a cir- 



cled-V 1072, and electrical switches, depicted as a cir- 
cled-S 1074. As herein used, the nomenclature for identi- 
fying a module pump control device is 1050, 1070, and 
the nomenclature for identifying a system pump control 
device is 1060, 1070. Other control devices, such as fans, 
compressors and variacs for example, may be employed 
as appropriate for carrying out the control function herein 
disclosed. 

[0032] The plurality of sensors 1020, 1030 provide a plurality of 
sensor signals from either the system modules of module 
set 1000, or power system 10 as a whole, with the re- 
spective signals being received at common data bus 110. 
While reference is made herein to Figure 5 regarding the 
signal flow and control scheme of power system 10, it will 
be appreciated that a similar arrangement applies to the 
modular configuration depicted in Figure 4 and to any 
other modular configuration of system modules that may 
be employed in practicing the teachings of the present in- 
vention. 

[0033] The sensor signals are received from common data bus 
110 at local controller 610 and/or CTM 600, depending 
on whether a centralized or distributed control scheme is 
implemented as discussed above, and analyzed for the 



presence of an abnormal operating condition or for the 
presence of a malfunctioning device, where the malfunc- 
tioning device may include, for example, a sensor 1020, 
1030, a processing element 200, 300, an output device 
90, 40, a control device 1050, 1060, or any combination 
thereof. 

[0034] upon receipt of sensor or device information, by continu- 
ous polling by CTM 600 and/or local controller 610, or by 
continuously monitoring the signal traffic on common 
data bus 110, for example, processor 620 accesses oper- 
ational information in a lookup table in memory 630 to 
determine whether that particular sensor or device is pro- 
viding a normal operational reading. The lookup table in 
memory 630 may be an actual table of values upon which 
processor 620 performs an interpolation/extrapolation 
technique, or may be a transfer function upon which pro- 
cessor 620 performs a calculation. In response to proces- 
sor 620 determining that an abnormal operating condition 
exists, processor 620 then determines whether an opera- 
tional adjustment is desirable at one of the control devices 
at the system module level or at the power system level. 
An adjustment may be made to either compensate for the 
abnormal condition, or to accommodate for the malfunc- 



tioning device, discussed further below. It should be 
noted that not all abnormal operating conditions reported 
by a sensor may warrant an operational adjustment. For 
example, if a sensor is unhealthy, discussed further be- 
low, or if a sensor reading is just outside of an acceptable 
range, then processor 620, via the embedded application 
software, may seek information from other sources to de- 
termined whether an operational adjustment should be 
made. Also, if a sensor is healthy, but reports an abnor- 
mal condition, processor 620 may use statistical tools 
such as trending or control sampling to determine 
whether an operational adjustment should be made. An 
abnormal condition may be the result of an anomaly, a 
data point that is an outlier, or the result of signal noise, 
in which case the utilization of statistical techniques by 
processor 620 may avoid unwarranted system adjust- 
ments. Other decisions regarding the desirability of an 
operational adjustment may come from processor 620 ac- 
cessing a lookup table at memory 630 to determine 
whether the sensors are sensing operating characteristics, 
and thereby reporting on operating conditions, that are 
within an expected range for the existing power condition 
and fuel consumption of power system 10. In conjunction 



with the lookup table at memory 630, processor 620 may 
employ interpolation or extrapolation techniques, or other 
algorithms, for comparing sensed operating characteris- 
tics to expected operating characteristics at a given sys- 
tem power level. In response to processor 620 determin- 
ing that an operational adjustment is desirable, processor 
620 automatically adjusts a control device 1050, 1060, by 
changing the operating state of at least one of a pump 
1070, a valve 1072, a switch 1074, or any combination 
thereof, for example, in a direction to compensate for the 
abnormal condition, or to accommodate for the malfunc- 
tioning device. For example, if the temperature or pres- 
sure at an electrolyzer 700 at an ELM 200 is above nor- 
mal, then processor 620 may reduce the flow of process- 
ing water and the available power by adjusting a pump 
1070 or a valve 1072 and operating a switch 1074 at the 
effected ELM 200. Also, if a system module pump 1050, 
1070 malfunctions and continued operation of that mod- 
ule would risk the integrity of the module and possibly the 
integrity of the power system 10 as a whole, then proces- 
sor 620 may shut down the operation of that particular 
module to prevent an entire system shutdown, which in 
essence results in an automatic reconfiguring of the con- 



trolled operational devices and the control system as a 
whole. In an embodiment, processor 620 may run power 
system 10 at reduced performance to accommodate the 
malfunctioning device or loss of data therefrom. 

[0035] | n an alternative embodiment employing MPS 100 as de- 
picted in Figure 4 with a plurality of fuel cell power mod- 
ules 390, a failure of one module may be detected by the 
remaining modules via common communication bus 110, 
whereby the remaining modules make compensating ad- 
justments using logic contained in local controllers 310. 

[0036] | n another alternative embodiment employing MPS 100 as 
depicted in Figure 5 having a plurality of Electrolyzer 
Modules 200, a temperature sensor failure in one module 
may be compensated for by temperature readings at a 
similar temperature sensor in another module based on 
algorithmic assumptions about present operating modes 
of both modules and predefined physical and mathemati- 
cal relationships between similar units that may be run- 
ning at slightly differing operating conditions or modes. 

[0037] in a further alternative embodiment employing MPS 100 
as depicted in Figure 5, the loss of an ambient tempera- 
ture sensor in Power Module 300 may be synthesized us- 
ing the temperature reading at WHSM 900. The synthesis 



may include mathematical formulas and interpolation ta- 
bles that represent the physical relationship between 
these temperatures under idealized theoretical data and/ 
or previously measured data. 
[0038] jo ensure high reliability for autonomous control of 

power system 10, redundant sensors and multiple channel 
communication may be employed, thereby enabling an 
operating characteristic monitored by a particular sensor 
to be derivable from one or more other sensors in the 
system. In this manner, redundant system information is 
available from a plurality of sources and over a plurality of 
channels for determining whether an operational adjust- 
ment of MPS 100 or a portion thereof is desirable. In some 
cases, it may be necessary to shut down MPS 100 or a 
portion thereof, and in other cases it may just be neces- 
sary to store the data relating to the operating character- 
istics of MPS 100 at memory 630 and to report the stored 
data to an external system or user on demand via signal 
interface 605. Processor 620 and embedded application 
software are configured for multi-channel communica- 
tion. In an embodiment, processor 620 may utilize a por- 
tion of the stored data using programmed adaptive logic 
to synthesize a replacement signal or to command a de- 



graded operational mode. 
[0039] Although a common bus 110 is shown for illustration, 
power system 10 may be configured using the invention 
described herein by employing a redundant common bus 
communications scheme, best seen by now referring to 
the communications architecture 1200 depicted in Figure 
6. In reference to Figure 6, elements of power system 10 
are depicted generally as Elements A, B, C, D and E, and 
identified by numerals 1210, 1211, 1212, 1213 and 1214 
(1210-1214), respectively, which may refer to any of the 
aforementioned modules, and interconnecting lines be- 
tween Elements A, B, C, D and E represent lines of com- 
munication. Redundant channels 1205 are represented by 
double lines, as depicted between Elements A and C, and 
between Elements D and E, and non-redundant channels 
(simplex channels) 1215 are represented by single lines. 
In an embodiment, communication bus 110 may be con- 
figured as two or more segmented buses over which data 
may be transferred between system Elements 1210-1214 
in a parallel fashion to facilitate redundancy management. 
The two or more segmented buses may be composed of 
redundant channels 1205, simplex channels 1215, or any 
combination thereof. For example, communication be- 



tween Element A 1210 and Element E 1214 may occur di- 
rectly via simplex channel 1215, or indirectly via seg- 
mented buses composed of simplex channel 1215 to Ele- 
ment B 1211, simplex channel 1215 to Element D 1213, 
and redundant common bus 1205 to Element E 1214. 
Other communication paths will be readily recognized by 
one skilled in the art. In the preceding example, the utility 
of a redundant common bus communication scheme is 
achieved without actually requiring a single bus that is 
common to all elements, with inter-bus communications 
being accomplished via a microprocessor or other data 
translation hardware, firmware and/or software combina- 
tion. As depicted in Figure 6, the implementation of the 
redundant common bus communication scheme may be a 
combination of simplex and redundant channels arranged 
in a network between elements to facilitate a packet 
switching arrangement and ensure message delivery un- 
der single or multiple bus failures. In an embodiment, the 
communication architecture depicted in Figure 6 may be 
implemented using a TCP/IP protocol over an Ethernet 
network. 

[0040] Referring now to Figure 7, an exemplary process 1100 for 
determining whether an operational adjustment should be 



carried out by processor 620 is depicted. Process 1100 is 
depicted as a continuous loop process, indicating a con- 
trol scheme that continuously monitors signal traffic on 
common data bus 110. At block 1105, processor 620 de- 
termines whether each sensor 1020, 1030 is reporting a 
normal operating condition. If yes, then control passes to 
block 1110 where power system 10 continues operation, 
and process 1100 continues by reentering decision block 
1105. If no, then control passes to block 1115 where pro- 
cessor 620 determines whether the reporting sensor is an 
unhealthy sensor. In an embodiment, a sensor may be 
considered to be unhealthy if it is not reporting any signal 
when it should or if its signal is representative of an 
unattainable value. In another embodiment, two sensors 
may be employed along with a voting scheme, whereby a 
high sensor reading in the first sensor may take prece- 
dence over a low sensor reading in the second sensor, 
thereby resulting in the second sensor being considered 
unhealthy. Other unhealthy sensor characteristics may be 
stored in memory 630 and used by processor 620 for 
comparative analysis. The number of sensors deployed to 
monitor a particular aspect of the power system opera- 
tion, such as pressure or temperature for example, is de- 



termined by the importance of that parameter with regard 
to the overall system operation. Also, the scheme to de- 
termine the health of any one sensor, such as averaging 
multiple sensors, selecting the closest two out of three, or 
using the highest or lowest reading, for example, is de- 
pendent on the importance of the parameter being sensed 
to the overall system operation. 

[0041] |f t he sensor is considered to be unhealthy, process con- 
trol passes to block 1120 where it is determined whether 
the sensed characteristic of the unhealthy sensor is deriv- 
able from one or more other sensors in power system 10. 
For example, in the two sensor scenario discussed above, 
the first sensor reading would take precedence over the 
second. In another example, a sensor reading at a system 
module sensor 1020 may be derivable via a set of system 
transfer functions involving both system module sensors 
1020 and power system sensors 1030, which collectively 
provide redundant information in the event that any one 
sensor becomes unhealthy. 

[0042] | n response to the sensed characteristic of the unhealthy 
sensor being derivable, process control passes to block 
1125 where processor 620 determines whether the other 
sensors in the system are reporting a normal operating 



condition. In determining that a normal operating condi- 
tion is present, process control passes to block 1110 and 
continues as discussed above. 

[0043] | n response to the sensed characteristic of the unhealthy 
sensor not being derivable, or in response to the derived 
characteristic by other sensors in the system being indica- 
tive of an abnormal operating condition, process control 
passes to block 1130 where it is determined whether an 
operational adjustment of a system module within module 
set 1000 is desirable, as discussed above. If it is consid- 
ered desirable to make no system module adjustment, 
process control passes to block 1135 where power system 
10 continues operation and process 1100 continues by 
reentering decision block 1105. 

[0044] |f jt i S considered desirable to make an operational ad- 
justment to a system module, process control passes to 
block 1140 where processor 620 automatically adjusts a 
control device 1050, 1060 in a direction to compensate 
for the abnormality, as discussed above. Following block 
1140, process control passes to block 1145 where pro- 
cessor 620 determines whether it is desirable to shutdown 
the operation of MPS 100 or a portion thereof, such as 
when the integrity of the system is at risk for example. If 



no, then process control passes to block 1135 and pro- 
cess 1100 continues as discussed above. If yes, then pro- 
cess control passes to block 1150 where processor 620 
shuts down MPS 100 or a portion thereof. 
[0045] Some embodiments of the invention may include some of 
the following advantages: autonomous control; no or very 
low maintenance; built in safeguards; system segmenta- 
tion through modularity of design; centralized or dis- 
tributed control arrangements; data recording and report- 
ing on demand; and scaleable system through modularity 
of design. 

[0046] while the invention has been described with reference to 
exemplary embodiments, it will be understood by those 
skilled in the art that various changes may be made and 
equivalents may be substituted for elements thereof with- 
out departing from the scope of the invention. In addition, 
many modifications may be made to adapt a particular 
situation or material to the teachings of the invention 
without departing from the essential scope thereof. 
Therefore, it is intended that the invention not be limited 
to the particular embodiment disclosed as the best or only 
mode contemplated for carrying out this invention, but 
that the invention will include all embodiments falling 



within the scope of the appended claims. Moreover, the 
use of the terms first, second, etc. do not denote any or- 
der or importance, but rather the terms first, second, etc. 
are used to distinguish one element from another. Fur- 
thermore, the use of the terms a, an, etc. do not denote a 
limitation of quantity, but rather denote the presence of at 
least one of the referenced item. 



